How To Remove: kavo.exe and tavo.exe



Use at your own risk: WhatTheTech forum's, does not take responsibility for any outcome of following these directions. Every computer is different, so we cannot guarante the outcome. If you are apprehensive, please post a log from HijackThis in the designated forum and let us take a look and guide you to a clean system.

This is a "self help" to remove the kavo.exe and tavo.exe infection.

Keep in mind this infection can be accompanied by other infections as well. We strongly suggest you Register after running this fix and posting a HijackThis log for one of the pro's to check over.


Please do not delete anything unless instructed to.



Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Next:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.


To prepare your computer for the help we offer, you can safely do the following before obtaining help:

1. You can get a complete installer that installs HijackThis to C:\Program Files\HijackThis, making an entry in the start menu and also providing a desktop shortcut from http://www.whatthetech.com/hjt202/HJTInstall.exe.
2. Click on the link and select Save, save it to your desktop.
3. Go to the HijackThis Logs and Spyware/Malware Removal
4. Click the
5. Double click the HJTsetup.exe file on your desktop to install it.
6. Open HijackThis and select: Do a system scan and save a log file.
7. When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here please use the button below.
8. Give the thread a title that describes your problem and in the post please explain what is happening to your PC and what you have tried to do so far to fix it.
   Do NOT fix anything that you see in the log (scanning will not make any changes to your computer).

Posting Guidelines:

1. Please copy and paste your log. DO NOT add it as an attachment
2. Post in one thread only. Use Add Reply (another button at the top of the list of posts in the forum, with the New Topic button) to answer or post new logs when they are requested, instead of starting another New Topic.
3. If you have run and fixed anything with any programs please reboot before scanning with HJT
4. Please DO NOT bump your log. Posting in multiple threads may also slow a reply to your post.
5. You can also go to the #whatthetech chatroom to ask for help with your problem, but you will still need to post your HJT log in the forum. You will require an IRC chat program or you can use the Java applet?
6. We will get to you as soon as we can, often within a few hours. At times the forums are very busy and there are not many trained volunteers available, so please be patient.

Keep in mind this infection can be accompanied by other infections as well. We strongly suggest you Register after running this fix and posting a HijackThis log for one of the Malware Team pro's to check over.

If you are running Vista:
1. These tools MUST be run from the executable. (.exe)
2. With Admin Rights (Right click, choose "Run as Administrator")